Home

Description

An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.

PUBLISHED Reserved 2025-04-16 | Published 2025-10-22 | Updated 2025-10-22 | Assigner CERTVDE




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-239:Failure to Handle Incomplete Element

Product status

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Credits

Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse S+T finder

References

sauter.csaf-tp.certvde.com/...f/white/2025/vde-2025-060.json

cve.org (CVE-2025-41724)

nvd.nist.gov (CVE-2025-41724)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.